data "aws_iam_role" "jenkins_pipeline_agent" {
  name = "prod-jenkins-aws-pipeline-agent"
}

data "aws_iam_policy_document" "bucket_readonly_policy" {
  statement {
    actions = [
      "s3:GetObject",
      "s3:GetObjectVersion",
    ]

    resources = [
      "${module.s3_bucket.s3_bucket_arn_output}/*",
    ]
  }

  statement {
    actions = [
      "s3:GetBucketLocation",
      "s3:ListAllMyBuckets",
    ]

    resources = [
      "*"
    ]
  }

  statement {
    actions = [
      "s3:ListBucket",
      "s3:ListBucketVersions",
    ]

    resources = [
      module.s3_bucket.s3_bucket_arn_output,
    ]
  }
}

resource "aws_iam_policy" "bucket_readonly_policy" {
  name        = "S3-${module.s3_bucket.s3_bucket_name_output}-RO"
  description = "S3-${module.s3_bucket.s3_bucket_name_output}-RO"
  policy      = data.aws_iam_policy_document.bucket_readonly_policy.json

  tags = {
    environment  = var.environment
    service_name = var.service_name
    terraformed  = true
  }
}

data "aws_iam_policy_document" "bucket_readonly_role_assume_role_policy" {
  statement {
    actions = ["sts:AssumeRole"]

    principals {
      type = "AWS"

      identifiers = [
        data.aws_iam_role.jenkins_pipeline_agent.arn
      ]
    }
  }
}

resource "aws_iam_role" "bucket_readonly_role" {
  name               = "S3-${module.s3_bucket.s3_bucket_name_output}-RO-role"
  assume_role_policy = data.aws_iam_policy_document.bucket_readonly_role_assume_role_policy.json

  tags = {
    environment  = var.environment
    service_name = var.service_name
    terraformed  = true
  }
}

resource "aws_iam_role_policy_attachment" "bucket_readonly_role_policy_attachment" {
  role       = aws_iam_role.bucket_readonly_role.name
  policy_arn = aws_iam_policy.bucket_readonly_policy.arn
}